Validation and Secure Input

Never trust input from a browser. Every value that reaches your server could be empty, the wrong type or deliberately hostile.

Validate Early

Check that the value exists, trim whitespace and check its shape before using it. Collect all errors so the user can fix them at once.

<?php

$errors = [];
$email = trim($_POST['email'] ?? '');
$password = $_POST['password'] ?? '';

if ($email === '') {
    $errors[] = 'Email is required.';
} elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    $errors[] = 'Enter a valid email address.';
}

if (strlen($password) < 8) {
    $errors[] = 'Password must be at least 8 characters.';
}

if ($errors) {
    foreach ($errors as $error) {
        echo '<p>' . htmlspecialchars($error) . '</p>';
    }
}

Escape Output

Cross-site scripting happens when user text is printed as HTML. Always run output through htmlspecialchars with ENT_QUOTES.

<?php

$name = $_GET['name'] ?? 'Guest';

echo 'Hello, ' . htmlspecialchars($name, ENT_QUOTES, 'UTF-8');

Prepared Statements

Never paste input into SQL. Prepared statements send the query and the values separately, so the database never treats input as code.

<?php

$pdo = new PDO('mysql:host=localhost;dbname=school', 'root', '');
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);
$user = $stmt->fetch();

Practice

1. Validate a phone number that must contain exactly 11 digits.
2. Escape a username before printing it inside an HTML attribute.
3. Rewrite an unsafe query using a prepared statement.

Hands-on exercise

Write PHP that validates a signup form.
1. name is required and at least 2 characters.
2. email is required and valid.
3. password is at least 8 characters.
4. Print every error inside htmlspecialchars().

Recap

Validate every input, escape every output and use prepared statements. These three habits prevent most common web vulnerabilities.